Refactor PLM to use the canonical Learning Mode analyzer - #760

src/host/plm/src/analysis.rs:90

• This conversion no longer applies the legacy AppPath-based self-access filter. The downstream filter only compares against bin_path, but wxc --audit invokes plm stop without --bin-path (src/core/wxc/src/main.rs:1331), so it defaults to the plm executable directory and cannot identify the audited workload's executable. Self-open events that the removed access_failure decoder dropped will therefore be persisted as unnecessary filesystem grants. Preserve this filtering in the canonical decoder before AppPath is discarded, or carry the needed metadata into this adapter.

                    events.push(LearningModeAccessEvent {
                        time_created: chrono::Utc::now(),
                        process_id: denial.pid,
                        thread_id: 0,
                        file_path: denial.resource.clone(),
                        access_mask,
                    });

src/host/plm/src/analysis.rs:70

• The removed parser rejected control characters and Windows wildcard characters before producing policy entries, but this adapter now checks only the drive prefix and current directory. The canonical analyzer accepts absolute paths without that filename validation, and config::normalize_path also does not reject these characters, so a denial such as C:\data\*.txt can now be persisted into an adjusted policy. Restore the legacy path-shape check before creating the access event.

                if !is_local_drive_path(&denial.resource)
                    || is_current_directory_path(&denial.resource, current_directory)
                {

src/host/plm/src/analysis.rs:72

• These canonical file denials are promoted without the legacy looks_like_valid_path check, which rejected control characters and Win32 wildcard characters. An attempted path such as C:\foo* can therefore reach readwritePaths/readonlyPaths, producing a policy entry that the old generator intentionally excluded. Retain that validation in the compatibility adapter.

                    events.push(LearningModeAccessEvent {
                        time_created: chrono::Utc::now(),
                        process_id: denial.pid,
                        thread_id: 0,
                        file_path: denial.resource.clone(),
                        access_mask,

src/host/plm/src/analysis.rs:69

• The compatibility adapter drops the legacy per-event self-access filter. The removed decoder compared each denied object with that event's application path, but DeniedResource carries no application path and wxc's audit stop call does not pass --bin-path; consequently, accesses to the workload executable can now be promoted into the generated policy. Preserve enough event attribution to apply the old self-access exclusion before creating these compatibility events.

    for denial in denials {
        match denial.resource_type {
            ResourceType::File => {
                if !is_local_drive_path(&denial.resource)
                    || is_current_directory_path(&denial.resource, current_directory)

src/backends/learning_mode/windows/src/extractors.rs:226

• This self-access check drops different files that share the same volume-relative path. For example, ObjectName = D:\Tools\app.exe and AppPath = C:\Tools\app.exe both reduce to \Tools\app.exe, so the real denial on D: disappears from both canonical captureDenials output and the compatibility policy. When both inputs are DOS paths, compare their full paths (including drive); use the volume-relative fallback only when a device-form path prevents that comparison.

        volume_relative_path(object_name),
        volume_relative_path(app_path),
    ) {
        (Some(object_relative), Some(app_relative)) => {
            !object_relative.is_empty() && object_relative.eq_ignore_ascii_case(app_relative)